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PREFACE 


This study was initiated as Subtask 1, TNT Equivalency Study to NASA Study 
C-II, Advanced Missions Safety Studies . Other studies in this series are 
Subtask 2, Safety Analysis of Parallel versus Series Propellant Loading of 
the Space Shuttle (Aerospace Report No. ATR-71(7233)-1) and Subtask 3, 
Orbiting Propellant Depot Safety Study (Aerospace Report No. ATR-71(7233)-3). 

This study was supported by NASA Headquarters and managed by the Advanced 
Missions Office of the Office of Manned Space Flight. Mr. Herbert Schaefer, 
the Study Monitor, supported by Mr. Charles W. Childs of the NASA Safety 
Office, provided guidance and counsel that significantly aided this effort. 


Study results are presented in three volumes; these volumes are summarized 
as follows: 

Volume I: Management Summary Report presents a brief, concise 
review of the study content and summarizes the principal conclusions 
and recommendations. 

Volume XI: Technical Discussion provides a discussion of the 
available test data and the data analysis. Details of an analysis 
of possible vehicle static failure modes and an assessment of 
their explosive potentials are included. Design and procedural 
criteria are suggested to minimize the occurrence of an 
explosive failure. 

Volume III: Appendices contains supporting analyses and backup 
material. 
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ABSTRACT 


This study reevaluates the existing TNT equivalency criterion for LO^/LH^ 
propellant. It addresses the static, on-pad phase of the space shuttle launch 
operations and was performed to determine whether the use of a TNT equiv- 
alency criterion lower than that presently used (60%) could be substantiated. 
The large quantity of propellant on-board the space shuttle, 4X10^ lb, was 
considered of prime importance to the study. 

Furthermore, a qualitative failure analysis of the space shuttle (EOS) on the 
launch pad was made because it was concluded that available test data on the 
explosive yield of LO^/LH^ propellant was insufficient to support a reduction 
in the present TNT equivalency value, considering the large quantity of pro- 
pellant used in the space shuttle. The failure analysis had two objectives. 

The first was to determine whether a failure resulting in the total release of 
propellant could occur. The second was to determine whether, if such a 
failure did occur, ignition could be delayed long enough to allow the degree 
of propellant mixing required to produce an explosion of 60% TNT equivalency 
since the explosive yield of this propellant is directly related to the quantities 
of LH^ and LC^ mixed at the time of the explosion. 

The analysis indicates that the occurrence of such a failure is unlikely and 
that a TNT equivalency of 20% would be a more realistic value for the static, 
on-pad phase of the space shuttle launch operations. 
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1. INTRODUCTION 
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1.1 BACKGROUND 

Investigators of the explosive phenomena of propellants have suggested that the 
current TNT equivalency value for LO^/LP^ propellant may be too high. If 
the existing equivalency criterion could be lowered for the space shuttle, there 
would be a potential for lower siting, facility and operational costs. A TNT 
equivalency value of 20% has been suggested. 

1.2 STUDY OBJECTIVES 

The objective of this study was to evaluate and recommend a TNT equivalency 
criterion for LO^/LH^ propellant applicable to the static, on-pad operational 
phase of the space shuttle, the new criterion to be as low a value as possible 
consistent with a reasonable level of confidence and hazard expectation. Fur- 
ther, the data were to be developed in a manner that would support a proposal 
to the Armed Services Explosive Safety Board (ASESB) requesting concurrence 
with the recommended criterion. 

1.3 STUDY SCOPE 

The study was confined to the static, on-pad phase of space shuttle (EOS) vehicle 
operations, i.e., from the start of propellant loading to launch. Dynamic 
impacts following launch were not addressed. 

No additional testing was included in the study; therefore, the data analysis 
was a reevaluation of the results of prior test programs and studies. 

A gross failure analysis was performed using the preliminary configurations 
and hardware definitions from the Phase B Space Shuttle Studies. 

1.4 STUD Y PLAN 

1.4.1 Approach 

The general plan followed in this study was to collect and analyze existing data, 
perform failure mode analysis, and establish suggested criteria. 
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Resources /Date Base 
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Many NASA and contractor technical reports and other documents were 
reviewed in the course of the study. References to specific reports used 
are given throughout the report in the sections to which they apply. 
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2. DATA ANALYSIS 


2. 1 LITERATURE SEARCH 

A literature search was made for documents dealing with LO^/LH^ explosions. 
Of the documents reviewed, twenty- five contained information directly appli- 
cable to this study (see Section 2.3). 

In addition, the search identified the principal investigating organizations and 
sources of LO^ 

tors, all of whom analyzed test data, and indicates those who produced their 
own experimented data. 


/ LH^ explosive test data. Table 1 lists the principal investiga- 


Table 1. Principal Investigators 



The University of Florida instrumented two tests in 
the URS Project Pyro test series and performed 
laboratory- scale simulation tests in support of their 
analytical studies. These studies are discussed in 
Appendix C , Vol . Ill . 


2.2 DETERMINATION OF EXPLOSIVE YIELD 

Propellant explosive yield is determined by comparing measured shock-wave 
characteristics with those of TNT. TNT is generally accepted as the standard 
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of comparison for explosive yield although it is recognized that the shock-wave 
characteristics of liquid propellant explosions resemble those of TNT only in 
the far field. The characteristics of explosive yield on which the comparison 
is based are peak overpressure and positive phase impulse. The latter is the 
area under the time-history curve of overpressure for the positive pulse 
measured at a given distance from the source. 


Propellant explosive yield in the far field is given by: 


Yield (% TNT) = X 100 


where 


the equivalent weight of TNT is that weight of TNT that would produce a yield 
equal to the yield resulting from an explosion of a given weight of propellant, 
and the total propellant weight is the total weight of propellant available at the 
time of the explosion, 

2 . 3 OVERVIEW OF AVAILABLE LC^/LHU 

EXPLOSION TEST DATA 

This phase of the study involved examining and comparing test data from all 
pertinent experimenting agencies. Although all investigators reported yields 
in terms of TNT equivalence, the basis for comparing the available data 
varied (pressure yield, impulse yield, and an average of these were used). 
Therefore, a common baseline had to be established before any comparison 
could be made; pressure yield was selected. 

The data were converted to pressure yield by superimposing the raw experi- 
mental data on the Ballistic Research Laboratory (BRL) curves for TNT 
explosions (see Ref. 1). No attempt was made to adjust any of the data points 
or to provide mathematical best fits to the TNT curves since the number of 
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data points did not appear to justify such an effort. Instead, a curve was 
visually faired through the data points; the terminal yield was then determined 
by visual approximation. The independently determined yields are tabulated 
in Appendix A (see Vol. Ill of this series) along with the values reported by 
the experimenters. 

The faired curves were of two general types. An example of the first type 
(see Fig. 1) shows the test yield increasing with distance from the explosion 
and eventually fairing into the 25% TNT curve. The pressure yield assigned 
in this case was thus 25%. 

In the second example (see Fig. 2), the test yield first decreases with 
distance from the explosion, then increases, and is apparently still 
increasing at the last recorded data point. No attempt was made to extra- 
polate the data curve since it could not reasonably be faired into the TNT 
line at any distance. There is no obvious basis for adjusting any of the data 
points on the assumption that one or more may be spurious and thus changing 
the slope of the curve. In this case, the highest yield indicated by the data 
(50%) was used. It was noted in this investigation that a large majority of 
the test data plotted produced curves of the first type (see Fig. 1) rather than 
the second (see Fig. 2). 

Pressure yields for all available data, determined as described above, are 
shown in Table 2 and plotted in Fig. 3. Also, bar representations of the range 
of yields reported by NASA-MSFC, for which no tabulated data were available, 
are shown in Fig. 3. 

In addition, Fig. 3 provides an overview of the available LO^ 
and clearly shows that the bulk of the testing has been conducted with propellant 
quantities of 225 lb or less. It is also evident that, for small-scale propellant 
very wide range of yields can be produced, depending on the conditions unde,: 
which the explosion occurs. 


/ LH^ test data 
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Table 2. Pressure Yields Determined Graphically 
from Investigators' Test Data (Continued) 
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URS 


URS 


Teat 

Method 
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No. 

Propellant Weight, 
lb 

Presaure Yield, 
%TNT 

164 

200 

3. 5 

161 


5 

104 


5. 5 

105 


6 

165 


8 

116 


9 

115 


9 

152 


11 

153 


13 

19' 


15 

184 


16 

230 


18 

231 


20 

203 


25 

103A 


26. 5 

201 


30 

225 


30 

254 


30 

150 


30 

160 


30 

252 


40 

204 


40 

151 


40 

113 


45 

226 


50 

229 


60 

251 


60 

114 


60 

195 


100 

211 

1000 

5 

216 


6 

266 


8 

264 


15 

215 


15 

217 


25 

262 


40 

289 

25,000 

3 

290 


3 

283C 


15 

132 

200 

4.5 

133A 


5 

131 


6 

185 


6 

186 


9 

224 


13 

183 


15 

196 


15 

223 


17 

228 


30 

253 


35 










t 

Also shown in Fig. 3, but not so readily acceptable, is the indication that 
when large quantities o£ propellant are involved (1000 lb or more), low 
terminal yields and small dispersion of yields are apparently experienced. 

The reluctance to accept this trend results from the facts that few large-scale 
tests were conducted and few variations of simulated failure modes were 
employed. Whether or not total propellant mixing for large-scale releases 
can be obtained is not conclusively demonstrated by the available data. There- 
fore, it cannot be concluded that yields higher than those indicated for large- 
scale tests cannot be achieved. 




Examination of the small-scale test results shows that the highest yields 
occurred in the spill te^ts. These were designed to achieve rapid, thorough 
mixing with the objective of producing high yields. There is no cor elusive 
experimental evidence that larger quantities of propellant will behave similarly, 
so there are no bases for evaluating scale effect or for establishing the 
credibility of such a failure mode for larger quantities. Similarly, the dewar 
tests, designed to promote rapid mixing by suddenly creating a large propellant 
interface area, do not extend over a range of propellant weights large enough 
to establish scale effects. On the basis of these considerations, both the spill 
and the dewar test results were excluded from further analysis. 

The data remaining include only the Pyro and NASA tank-test results. Since 
no tabulated data were available for the NASA tests, no data points could be 
plotted; these test results also were excluded. Thus, the Pyro test series, 
which represents only two basic failure modes, remained as the basis for 
analytical consideration. 

2.4 DATA EVALUATION AND ANALYSIS 

This section briefly summarizes the evaluation and analyses of the Project 
Pyro LO^/LH^ data as performed by URS and Bellcomm, bn addition, an 
independent evaluation of the data ic presented that uses data-point groupings 
different from those used in the URS or Bellcomm evaluations. The use of 
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different groupings illustrates some of the difficulties encountered in trying to 
arrive at a completely defensible conclusion based on the available data. 

2.4.1 URS Analyses 

Project Pyro was designed to provide an empirical basis for the development 
of a generalized method for predicting the blast environment resulting from 
the explosion of liquid propellant. Three test configurations were used in 
this program; they are referred to as Confined by Missile (CBM), Confined 
by Ground Surface - Vertical (CBGS-V), and Confined by Ground Surface - 
Horizontal (CBGS-H). These configurations are described in detail in Appendix 
B (see Vol. Ill of this series). 

The approach used by URS was to conduct a large number of small-scale tests 
to determine the effects of various parameters on yield and then to conduct 
a limited number of large-scale tests to verify the persistence of these 
relationships. Tables summarizing those LO^ 
vr lid by URS are given in Appendix A (Vol. Ill of this series). These tables 
present the test configurations and the terminal yields. The reported yields 
are approximate averages of the terminal pressure yields and the impulse 
yields. The data points excluded from the analysis by URS are also indicated 
in these tables. 

A significant criterion employed by URS for accepting a test for analysis was 
the control of ignition delay following tank failure since one of the test objectives 
as the determination of the effect of propellant-mixing time on yield. In 
several tests, particularly in those involving large propellant weights, auto- 
ignition apparently occurred. The results of these tests were excluded from 
the URS analysis because one of the required test conditions was violated. 

The general analytical approach used by URS was to formulate by trial the 
general relationships between yield and the variables investigated. Statistical 


/LH^ explosion tests judged 
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analyses were then performed, using these relationships to determine which 
of the trial equation forms and parameter combinations best explained the 
observed variation in yield. 

The two parameters that URS found to have the most significant effect on yield 
are the manner in which the LO^ and LH^ mix (the failure mode) and the ignition 
delay following tank failure. Yield prediction equations were developed for 
the two basic failure modes tested (CBM and CBGS); in these equations, yield 
is expressed as a function of scaled time. The use of scaled time is based on 
the URS postulate that ignition delay scales geometrically with propellant 
weight; this leads to the scaled time t"' being ignition delay time t divided by 
the cube root of the propellant weight. This relationship is written: 



A brief discussion of the results of the URS analyses of the CBM and CBGS 
cases follows. 

2.4. 1.1 Confined by Missile (CBM) - URS 

The URS CBM prediction equation and its corresponding curve, extracted from 
Ref. 4, are shown in Fig. 4. A legend identifying the tests used to develop 
the equation has been added to the figure as well as numbers identifying the 
test number associated with each data point. The prediction equation was 
based on an analysis of all nonspurious CBM cases except those having a 
tank-length-to-tank-diameter (L/D^) ratio of 1.8 and a rupture-diaphragm- 
diameter -to -tank -diameter (D /D.) ratio of 1. The latter restriction excluded 

O t 

three 200-lb tests. Also excluded as spurious are the data points for three 

25, 000-lb tests and a 91,000-lb test because all of these apparently exploded 

due to earlier-than-planned ignition. Two 200-ib, scaled, S-IV configuration 

tests with an L/D,. of 1.8 and a D /D, of 0.083 were also excluded. The data 
' t o t 
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points for these nine tests have been added to Fig. 4 to show their relationship 
to the prediction curve. 

The analytical approach used appears to be sound, and the prediction curves 
reasonable for the data points on which the analysis was based. However, 
the expected effect of ignition delay on yield for the 200-lb tests was not well 
demonstrated, nor was the repeatability of yield for similar ignition delays. 
The data on which the prediction equation is based consist of fourteen tests 
at 200 lb and four tests at 1000 lb of LO^, 
the lack of large-scale test results and the wide scatter of small-scale data 
at a given scaled time limit confidence in using this prediction method for 
vehicles with propellant weights in the millions-of-pounds range. 

2.4. 1.2 Confined by Ground Surface - Vertical (CBGS-V) - URS 

Figure 5, extracted from Ref. 4, is a plot of the CBGS-V prediction curves. 
Superimposed on this figure are the data points used in the analysis. The 
CBGS-V analysis was limited to data for tanks with an L/D =1.8. Excluded 
from the analysis were the yields for two 200-lb tests, five 1000-lb tests, 
and three 25,000-lb tests, all with L./Dj_ = 1.8. These were apparently 
excluded because these explosions were self-ignitied or otherwise did not 
satisfy the test condition criteria. 

The data indicate a definite increase in yield with increased impact velocity, 
with very high yields at velocities corresponding to the drop heights that 
could be expected with space shuttle vehicles involving large propellant 
weights. As in the case of the CBM analysis, however, eighteen data points 
are for 200-lb tests and two are for 1000-lb tests. For the same reasons 
discussed in the CBM case, little confidence could be placed in applying 
these curves to very large vehicles. 

2.4.2 Bellcomm Analysis 

Bellcomm performed an independent statistical analysis of the Project Pyro 
data. They concluded that a simple regression analysis of yield vs propellant 


/LH^. As discussed in Sec. 2.3, 



VEL, ft/sec DROP HEIGHT, ft 
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Comparison of URS Prediction Equation for CBGS-V Case with Experimental Data 




I 

weight was a better approach than that used by URS, considering the previously 
discussed limitations of the Pyro data. The results of their analysis of the 
CBM and CBGS cases for LC^/LH^ are shown in Figs. 6 and 7. Bellcomm 
performed separate analyses of pressure and impulse yields (only the former 
has been reproduced here), whereas URS used an average of the two. Both 
investigators used the same definition of "spurious" tests*, but if one compares 
the data used in their analyses, some disagreement is indicated as to the 
tests that fit the definition (see Appendix A, Vol. Ill of this series). 

2.4.2. 1 Confined by Missile (CBM) - Bellcomm 

The Bellcomm analyses of the CBM case (see Fig. 6) were taken directly 
from Ref. 5. These results were based on data from tests involving only 
those tank configurations with an L/D ratio of 1.8 and a D /D ratio of 0.045. 

t O t 

Of the tests conducted with this configuration, three 200-lb, one 1000-lb, and 
three 25,000-lb tests were excluded from their analyses. The data points 
not used were excluded because of autoignition and/or very low yields. The 
_ regression line of yield vs propellant weight is strongly influenced by the 

^ single simulated S-IV test point. 

2. 4. 2. 2 Confined by Ground Surface (CBGS) - Bellcomm 

The Bellcomm analysis of the CBGS case was based on the same series of 
tests used by URS; in these tests, the propellant tank impact velocity was 
44 fps. Figure 7 presents the calculated regression curve and the data 
points used. The yields shown are those calculated by Bellcomm. Excluded 
from the calculation were the data from one 200-lb test, three 1000-lb tests, 
and two 25, 000-lb tests because the explosions were autoignited. It is 
obvious from an inspection of Fig. 7 that the regression line of yield vs pro- 
pellant weight would have been significantly altered had the additional data 
points been considered. 


^Spurious tests are those that experienced a failure mode other than the 
planned, controlled mode (tank or diaphragm rupture due to pressurization, 
premature fire, etc.). Such failures generally resulted in premature 
ignition . 

0 


k 




- 17 - 









The Bellcomm analysis indicates a decrease in yield with propellant weight 
but with rather large prediction limits. Although this analysis represents a 
different approach to the analysis of the data from that employed by URS, 
confidence in the results of either approach is limited by the lack of sufficient 
large-propellant-weight data. 

2.4.3 The Aerospace Corporation Analysis 

2.4. 3.1 Effect of Data Point Population 

As discussed earlier, an undesirable disparity exists in the number of data 
samples available at the various propellant test weights. This is particularly 
true since the data population decreases as the propellant weight approaches 
the magnitude of interest. With the Project Pyro data, this disparity would 
exist even if the results of all tests conducted were used as data points. Both 
URS and Bellcomm excluded several large-scale tests from their analyses 
primarily because ignition occurred earlier than the planned time. Thus, 
the small number of data samples at the larger propellant weights are further 
diminished. 

It can be argued that self-ignition test results could be used as data points 
on the basis that, statistically, a certain number of these explosions occurred 
in spite of efforts to control ignition. There is certainly no evidence that 
self- ignition cannot occur in an actual failure. The relative validity of this 
approach and of that used by URS and Bellcomm becomes somewhat academic 
when one considers that there are too few large-scale data points to support 
a conclusive statistical analysis in any case. However, this second approach 
is suggested simply as a means of examining the effect of additional data 
points (real rather them assumed) on the analytical results. 

Such an examination has been made in both the CBM and the CBGS cases; the 
result of adding data points is illustrated in Figs. 8 and 9. The Bellcomm 
analysis format has been used for convenience. For consistency, pressure 
yields recorded in Table 2 are shown; they were used in calculating the 
regression lines. 
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Fig. 8. Effect of Data Point Sets on LCk/LH, 
Yield Prediction Equation, CBM Case 
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• DATA SET A (USED BY BELLCOMM): 



Effect of Data Point Sets on 




2.4. 3.2 


Confined by Missile (CBM) - Aerospace 

The Bellcomm analysis of the CBM case was based on data from tests involving 

only those tank configurations with an L/D^ of i.8 and a D q /D^ of 0.45. Of 

the tests conducted with this configuration, one 1000-lb and t;/o 200-lb tests 

w^re excluded as spurious from the analyses. Data Set A (see Fig. 8) shows 

the points considered by Bellcomm. The three tests previously excluded by 

Bellcomm were included in The Aerospace Corporation's comparative 

analysis. In addition, four 200-lb tests with an L/D, of 5. 1 and a D /D. of 

tot 

0.45 were added since both URS and Bellcomm concluded that the effect of 
L/D^ ratio (for D q /D^. of 0.45) on yields is slight. The total number of these 
data points comprise Data Set B. Three 25, 000-lb CBM test results were 
not included in either Data Set A or B since all had extremely lov yields. 

Even though it is assumed that higher yields are possible because significantly 
higher ones were recorded for both the 1000-lb and 91, 000-lb propellant 
weights, these three 25,000-lb CBM data points were added to Data Set B 
to obtain Data Set C. 

Figure 8 compares the regression of pressure yield with propellant weight for 
the tests used in the Bellcom analyses (Data Set A) with similar regressions 
for the lrrger groups of tests (Data Sets B and C) used by The Aerospace 
Corporation. It can be seen that the inclusion of additional tests in Data Set B 
had little effect on the CBM regression line, primarily because of the strong 
influence of the single 91,000-lb point and tne fairly even distribution of the 
additional 200-lb test yields about the original line. Both lines have been 
extended to a propellant weight of 4 X 10^ lb (as indicated in Fig. 8) to illustrate 
the unreasonably large extrapolation required to approach the space shuttle 
propellant weight. The 95% prediction lines show little change in yield with 
propellant weight. The regression line for Data Set C shows a marked change 
in slope as the result of considering three low-yield points at 25, 000 lb of pro- 
pellant. In addition, the 95% prediction line indicates lower yield values as 
propellant weights increase; this also is attributable to the same three low- 
yield, 25, 000-lb data points. 



2. 4. 3. 3 Confined by Ground Surface (CBGS) - Aerospace 

Both URS and Bellcomm based their analyses of the CBGS case on data from a 
series of tests in which the propellant tank impact velocity was 44 fps. This 
series involved a greater range of propellant weights (200, 1000, and 25,000 lb) 
than did those with impact velocities of 23 fps and 78 fps. Of the tests in the 
44 fps series, Bellcomm excluded the data from one 200-lb test, three 1000-lb 
tests, and two 25,000-lb tests because they were self-ignited. The reduced 
series of test points is identified as Data Set A. These six tests were added 
in the comparative analysis of the CBGS case; the total group of data points 
comprise Data Set B. 

Figure 9 compares the regression of pressure yield with propellant weight 
for the tests used in the Bellcomm analysis (Data Set A) with a similar regres- 
sion for the larger group of tests (Data Set B) . The inclusion of the self-ignited 
CBGS tests results in a considerable change in the slope of the regress-ion line. 
In this case, the change effects a reduction in predicted yield at any given 
weight because the additional tests were all low-yield. Extrapolation to large 
propellant weights, in the range of 4 X 10^ lb, results in the prediction of 
extremely low yields. This approach demonstrates the sensitivity of the slope 
of the regression line to the addition of low-yield data points where none or 
only a few originally existed. Obviously, the addition of a few high-yield 
points at the 1000-lb and the 25,000-lb weights would significantly increase 
the predicted yield for large propellant weights. 

2.4.4 Assessment of Available Data and Analyses 

Since the current LO^/LH^ explosive safety criterion of 60% TNT equivalency 
is not identified with any specific failure mode, one might consider grouping 
all available LO^/LH^ explosion data from Project Pyro for analysis, regard- 
less of the failure mode. Furthermore, one could stipulate that the only 
requirements for the validity of the test data to be used are that the simulated 
failure mode is credible and that an explosion has occurred. The URS Project 
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Pyro data plotted in Fig. 10 generally satisfies these requirements for the 
two basic failure modes tested. This approach permits the use of all currently 
available test results (78 data points) for evaluating propellant quantity scaling 
effects. Figure 10 shows, however, that considerable disparity in data popu- 
lation exists between any two given test propellant weights. For a statistical 
analysis to be meaningful, the number of data samples at each propellant 
weight should be nearly equal. Despite the obvious limitation of the plotted 
data points in this respect, a simple regression analysis was performed, and 
the results are shown. However, this regression cannot be considered very 
significant because of the uncertainty created by the effect of the few widely 
scattered large-scale test yields on the slope of the curve. Little confidence 
could be placed in yields predicted by extrapolation of such data to propellant 
weights in the r illions-of-pounds range. 

The analyses conducted by Bellcomm and those presented here have yielded 
a series of prediction equations. These equations, which are summarized 
in Table 3, illustrate the sensitivity of the prediction equation to the inclusion 
or exclusion of large-propellant-quantity data points. While it is certainly 
more conservative to omit low-yield points and thus obtain a higher predicted 
yield, one wonders whether still higher yields might have been obtained had 
more tests been performed. 

The URS hypothesis that yield is a function of the normalized ignition delay 
* 1/3 

time (t = t/w ) is a reasonable approach. The hypothesis assumes that 
the time interval between propellant contact and ignition time t is known. 

For prediction purposes, a value of t must be assumed that will result in 

❖ 

the maximum yield that may occur. Establishing a proper value for t would 
be difficult, as is shown by the wide spread of yields obtained from tests using 
200 lb of propellant. Further, URS indicated that a range of yields similar 
to that of the 2 00 -lb test might have been obtained at the higher test weights 
if more extensive testing had been done. 
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PRESSURE YIELD, %TNT 



TOTAL PROPELLANT WEIGHT, lb 


Fig. 10. Regression Analysis of LO^/LH- Pressure Yield vs 
Propellant Weight u 
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Table 3. L0 0 /L»H 9 Explosive Yield Prediction Equations 



CBM Case 

Bellcomm 

Y = 17. 6 W" 0, 148 
P 

Independent 

Data Set A 

Y = 19. 5 W’ 0, 13 
P 

Data Set B 

Y = 10.7 W"°* 083 
P 

Data Set C 

Y = 279 W“ 0, 668 
P 

CBGS Case (44 fps) 

Bellcomm 

Y =7.38 W“ 0 ' 172 
P 

Independent 

Data Set A 

Y = 86. 5 W” 0 * 19 
P 

Data Set B 

-0 37 

Y = 195 W 
P 






It was an aim of Project Pyro to provide a generalized explosive yield- 
predicting tool, but the data covers only two basic failure modes. In order 
to predict explosive yields for other failure modes, it would be necessary to 
compare those other failure modes with the two for which data have been taken 
and to extrapolate the results to larger- or smaller -yield values for the new 
projected failure modes. 

Using the Project Pyro data, Bellcomm notes that yield plotted vs propellant 
weight shows a qualitative decrease in yield with increased propellant weight. 

If one assumes that the available data points represent a statistically valid 
data population, the regression line proposed by Bellcomm could be considered 
valid; however, the lack of sufficient data points at the higher propellant 
weights raises doubts as to the validity of such an assumption. These doubts 
are further reinforced by examination of the Project Pyro data grouping 
analysis, which demonstrated the effect of adding or subtracting test points, 
particularly in regions where few data points exist. 

The analytical approach to predicting explosive yields developed by Dr. Farber 
(see Appendix C, Vol. Ill of this series) is comprehensive and thorough but, 
again, additional large-scale data points are needed to arrive at an acceptable 
confidence level when one extrapolates to large propellant quantities. 

2.5 SUMMARY OF DATA ANALYSIS 

Examination of the available LC^/LH^ explosion data clearly shows that 
explosive yields vary over a wide range and that this variability depends 
on the failure mode or, stated in another way, on the mixing mechanisms 
involved. Explosive yield depends on the amounts of LO 2 and LH^ actually 
mixed before an ignition source is available. The time available for this 
mixing to take place, the interface area between the and the 
turbulence induced by velocity or heat transfer between the LC^ and the LI^, 
and the energy level of the ignition source are prime factors in the resulting 
yield. The rather wide spread of explosive yields observed under supposedly 
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identical test configurations and procedures cannot be explained by the recorded 
data, and the effects of prime factors and their interaction have not been 
isolated quantitatively. 

Figure 3, which shows all of the 
investigators, illustrates two things: Only Project Pyro provides test data 
for propellant quantities over 225 lb, and mixing mechanisms or failure modes 
other than the two considered in Project Pyro have not been investigated for 
propellant quantities greater than 22 5 lb. Therefore, it seems appropriate to 
consider Project Pyro data as the only basis for considering the scaling of 
LO 2 /LH 2 explosive yields to higher propellant weights, recognizing that 
Project Pyro provides data points for only two basic failure modes. Further, 
insufficient large-scale data points are available to permit positive, quantita- 
tive assessment of the explosive yields for propellant quantities in the millions- 
of-pounds range. 

r It is acknowledged that within the framework chosen by each of the investigators 

and with the assumptions that have been made based on the evaluation logic 
employed, little, if any, fault can be found with the execution of any of the 
analyses. However, conclusive proof in support of any of the prediction 
approaches used by the various investigators cannot be substantiated o^ the 
strength of the available data. 

2.6 CONCLUSIONS OF DATA ANALYSIS 

It is concluded that insufficient data exist to technically substantiate a general- 
ized reduction in the existing TNT equivalency criterion for LO^/LH^ propellant. 
However, an acceptable rationale may be developed based on an on-pad failure 
modes and effects analysis that would justify a waiver to reduce the TNT 
equivalency criterion specifically for the space shuttle. Such an analysis 
would take into account the vehicle and launch- site configurations and the 
quantity of propellant involved. 
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/ LH^ data points taken by the principal 
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3. FAILURE ANALYSIS 


3.1 GENERAL 

A failure modes and effects analysis was performed to assess the explosive 
hazards of the space shuttle vehicle during ground operations. Specifically, 
the study was confined to the static on-pad time interval between initial pro- 
pellant loading and vehicle liftoff (see Fig. 11). 


Since the vehicle design and operational criteri*’ are in the development phase, 
the failure analysis is, of necessity, a qualitative, top-level effort. The 
vehicle configurations and propellant weight , sed throughout the analysis are 
shown in Figs. 12 through 17. Recommended tan!;, structural design criteria 
(see Ref. 6) are presented below: 

• Leakage rather than rupture shall be the most 
probable failure mode. 

• The tank shall withstand a collapsing pressure 
differential during the drain cycle (a pressure 
equalization system may be substituted) 

• Recommended safety factors (to be verified or 
modified by best available design technique): 


Component 

Factors 

Yield Ultimate Proof 

Pressurized Lines and Fittings 

2.5 1.50 

Main Propellant Tank 

1.1 1.4 1.05 

Pressure Vessels (Other Than 


Propellant Tanks) 

2.0 1.50 


It is emphasized that the study was confined to on-pad conditions during the 
interval between the start of propellant loading and vehicle liftoff. However, 
in determining probable failure modes, the study could consider the con- 
tributions of the launch pad and the ground equipment to the result of a 
failure only generally because their configurations are still incompletely 
defined. 
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• ERECT • CREW INSERT 

• PRELAUNCH TEST PROCEDURE • ELECT ARM • ELECT ARM 

• INSTALL ORDNANCE • ORDNANCE i ORDNANCE 

(IF REQUIRED) OF REQUIRED) (IF REQUIRED) 

•REMOVE ERECTOR •COUNTDOWN •COUNTDOWN 


• PAD SAFETY REGULATIONS I • PAD SAFETY , • PAD SAFETY L PAD AND FLIGHT 
APPLY REGULATIONS REGULATIONS SAFETY 

APPLY APPLY REGULATIONS 

APPLY 









26 ft 


235 ft 



180 ft 



WEIGHT DATA, lb x 106 

BOOSTER 

ORBITER 

GROSS LIFTOFF WEIGHT 

4.2 

0.8 

TOTAL LOADED PROPELLANT 

3.4 

0.6 

LO 2 

2.9 

0.5 

lh 2 

0.5 

0.1 

NOTE : DIMENSIONS AND WEIGHTS ARE APPROXIMATE 


Fig. 12. Typical Vehicle Configuration 
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Fig. 15. Typical Orbiter Propellant Tank Arrangement (.Separate Tanks) 




6H 2 PRESS. REG. 



ig. 16. Schematic of Typical Orbiter Main Propulsion System (Separate Tanks 
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Consideration of probable failure modes suggests preventive action that could 
be implemented during vehicle design to provide an inherently less hazardous 
condition. Corrective action may be in the form of sensors that would initiate 
certain operating procedures and emergency actions and thus minimize hazards. 
Suggested preventive measures will be described as they are developed in the 
failure mode analysis, which was conducted in conjuntion wtih the fault tree 
definition; they are summarized in Sec. 3.3.6. 

3.2 FAULT TREE 

A fault tree was developed to systematically identify the events that could lead 
to a catastrophic failure (in this study, a catastrophic failure is defined as 
an explosion). Figure 18 presents the top level of the fault tree and sh vs 
the basic conditions (a propellant source, mixing, and an ignition source) 
deemed necessary to produce a catastrophic failure. The conditions identi- 
fied in Fig. 18 will be discussed in greater detail in the sections that follow. 
Although the main tanks are obviously included in the vehicle systems category, 
their size, function, and degree of exposure warrant a separate classification. 

The primary conditions analyzed are listed below. With the exception of leakage 
in the vehicle systems, these conditions were analyzed for failures contributing 
to the gross release of propellant: 

• Vehicle tank(s) ruptured 

• Tank overpressure 

• Tank collapse 

• Orbiter dropped 

• Vehicle tipover 

• Lightning strike 

• Fire 

• Tank struck by foreign object 

• Vehicle propellant system failure 
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3.3 


ANALYSIS 



3.3.1 Vehicle Tank(s) Ruptured 

Figure 19 presents an expansion of the fault tree that was developed to identify 
events resulting in the rupture of one or more of the main propellant tanks. 

At this point in the analysis, only failure potentially capable of a gross pro- 
pellant release were considered and analyzed. 

3.3. 1.1 Tanks Overpressurized 

Events that could result in propellant tank failures due to internal overpressure 
were placed in two main categories: gaseous overpressure and hydraulic 
overpressure. Gaseous overpressure results mainly from failures in vehicle 
systems; hydraulic overpressure results mainly from failures in the GSE 
branch of the propellant loading system. 

3.3. 1.1.1 Gaseous Overpressure 

Failures in three subsystems were identified and evaluated as potential sources 
of gaseous overpressure. The systems involved are the vent, pressurization, 
and fill and drain systems (see Fig. 20). The evaluation of the subsystems 
will be discussed in the following paragraphs. 

3.3. 1.1. 1.1 Vent/Pressure Relief System Failure 

Vent system failures can occur in either the vehicle or ground equipment 
branches of the system. Failure of the ground vent system as a source of 
vehicle overpressurization was considered so remote as to be negligible and 
is therefore not further evaluated. 

The vehicle vent system evaluated in this study was taken from contractor 
reports and is shown schematically in Fig. 21. The schematic shows that 
the vent and pressure relief functions are placed in parallel; a failure of both 
functions would be required before the tanks would be subjected to an over- 
pressure condition. The events that would produce such a failure are shown 
in a partial expansion of the fault tree (see Fig. 22). 
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Fig. 20. Fault Tree - Gaseous Overpressure 
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Fig. 2i. Schematic - Vehicle Vent and Fill and Drain Systems 
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A failure mode and effects analysis based on these events was conducted; the 
results are presented in Table 4. Failure rates of components comprising 
similar systems in the Saturn V are also presented in this table. The data 
indicate that the failure rates of these components are so low that this type 
of failure is unlikely. The remarks column shows that if both of these systems 
should fail, the fill and drain system might be used to drain the tank(s) and 
thereby relieve the pressure buildup. 

3.3. 1.1. 1.2 Fill and Drain System Failure 

A failure of the fill and drain system would not of itself result in a gaseous 
overpressurization of the propellant tanks. However, since this system was 
considered as a backup in case of a dual failure of the vehicle vent and pressure 
relief systems.- an analysis of failures that could negate this function is 
appropriate. It should be noted that the system can provide this backup capa- 
bility for a limited time only, i.e., until it is disconnected before launch. 

, The components of the fill and drain system pertinent to this analysis are 

shown in Fig. 21; they are the fill and drain valve and the fill isolation valve. 

A failure analysis for these components is also presented in Table 4. This 
analysis suggests that the failure rates for these components is low (based 
on data for similar valves in the S-V) and that system failure at these points 
would be unlikely. 

3.3. 1.1. 1.3 Pressurization System Failure 

Two systems that provide for pressurization of the main propellant tanks 
(see Fig. 23) were evaluated as potential sources of tank rupture due to 
overpressurization. The systems were the ground pressurization system, 
which prepressurizes the tanks prior to engine start, and Idle engine-bleed 
system, which maintains pressure after engine ignition. 

Components of these systems were subjected to a failure analysis (see Table 4), 
which indicates that a malfunction of these systems would not result in over- 
pressurization of the tanks. In addition, contractor data indicate that the 
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Failure (and Cause) 

Operating System 

Subsystem 

Major Component 
(and Failure Mode) 

Comp 

Failui 


Vehicle Vent System 


Vent Valve 
•'Fail to Open or 
Remain Open) 

1.47 PI 




Vent Isolation Valve 
(Fail to Open or 
Remain Open) 

3. 20 pp 


Pressure Relief 
System 


Burst Disc 
Vail to Rupture) 





Relief Valve 
(Fail to Open or 
Remain Open) 

1.47 pp 


GSE Pressurization 
System 


Regulator 
(Regulates High) 

6/2 ppr 




(Regulates Low) 

250 pc 

Propellant Tank Rupture 
(Gaseous Overpressure) 



Shutoff Valve 
(Fails to Close) 

16 ppm 




Pressure Switch 
(Fails to Actuate and 
Close Shutoff Valve) 

14 ppm 


Vehicle Fill and Drain 
System 


Disconnect 

(Premature 

Disconnect) 





Fill and Drain Valve 
(Fail to Ooen) 

J. . 47 pr 




Fill Ijolation Valve 
(Fail to Open) 

3. 20 pp 


Vehicle Pressurization 
System 


Engine Bleed Check 
Valve 

(Fails to Open) 
(Fails to Close) 

1 ppm/ 
17 ppm 


Propellant Tanks 


Propellant Tank 
Insulation 

(Insulation Damaged - 
Excessive Boiloff) 1 

■ — ■ -i 

1 


* Based on Saturn data, ambient conditions, 90% confidence (see Ref. 7) 
^Prior to disconnect for launch (see Ref. 7) 
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Component . 
Failure Rate 1 


Effect of Failure 


Remarks 


1. 47 ppm/cy 


3. 20 ppm/cy 


Increases Internal Pressure in Propellant 
Tanks. If Not Relieved Will Result in Rupture 
of Propellant Tank. 

Propellant(s) Released: Potential Fire or 

Explosion 


Backed Up by: 

Burst Disc/Relief Valve 
Fill and Drain System^ 


1. 47 ppm/cy 


Backed Up by: 

Vent System 

Fill and Drain System 2 


672 ppm /hr 


250 ppm/hr 

16 ppm/cy 
14 ppm/hr 


Backed Up by: 

Isolation Valve 

Vehicle Vent and Pressure Relief 
Systems 

Vehicle Fill and Drain System 2 
Will Not Overpressurize Tank 
Backed Up by: 

Vehicle Vent and Pressure Relief 
Systems ? 

Vehicle Fill and Drain System 2 


1. 47 ppm/cy 


Utilized to Reduce Tank Pressure 
if Both Vent and Relief Systems Fail 
during Prelaunch Operations 


3. 20 ppm/cy 


1 ppm/cy 
17 ppm/cy 



Will Not Cause Tank Overpressure 


Backed Up by: 

Vehicle Vent and Pressure Relief 
Systems _ 

Vehicle Fill and Drain System 4 


Table 4. Failure Analysis 
Tank Rupture 


- Propellant 
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iponent 
re Rate* 

Effect of Failure 

Remarks 


Increases Internal Pressure in Propellant 
Tank(s). If Not Relieved Will Result in 
Rupture of Tank(s). 

Backed Up by: 

System Redundancy, Continual 
Monitor, and Manual Override 


Propellant(s) Released: Potential Fire or 
Explosion 

Provisions 

>m/hr 

n/cy 

n/hr 

Internal Tank Pressure Negative with Respect 
to Ambient Tank. 

Walls May Collapse. 

Propellant(s) Released: Potential Fire or 
Explosion. 

Design Criteria Requires Tanks 
Capable of Withstanding Collapsing 
Pressure 

Pressure Equalization System an 
Acceptable Alternate 

/ cy 




Orbiter Dropped, Tanks Ruptured, and 
Propellants Spilled. 

Separation Mechanism Must Service 
3-g Launch Loads 


Potential Fire or Explosion, Loss of EOS 
Vehicle 

1. 5 Safety Factor Recommended 

Accessible for Rigorous Inspection 
Prior to Each Flight 



Not a Likely Failure Mode Under 1-g 
Static Conditions 


Orbiter Dropped, Tanks Ruptured, and 
Propellants Spilled 

Potential Fire or Explosion, Loss of EOS 
Vehicle 

Inadvertent Actuation Preventable by 
Providing Safe /Arm Switch and Inter- 
lock Mechanism to Prevent Arming 
Prior to Liftoff 

Shielding of Ordnance Combined with 
Extensive EMI Control Program Will 
Minimize Probability of Actuation by 
Spurious Signal 


Possible Propellant Release 
Lightning also Provides Ignition Source 

Occurrence Can Be Minimized by: 

Not Fueling Vehicle When High Storm 
Probability Is Forecasted 
Proper Grounding of Vehicle 



Low Yield Expected 
Short Mixing Time 



Table 4. Failure Analysis - Propellant 
Tank Rupture (Continued) 
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vent/pressure relief systems are capable of maintaining tank pressure within 
specifications when either of the pressurization systems is operating at full 
capacity. 

Consideration of overpressure due to excessive boiloff as a result of insula- 
tion damage completes the analysis of possible tank rupture modes due to 
gaseous overpressure. Here agaia, the capacity of the vent/pressure relief 
systems would be more than adequate to handle the increased pressure. Also, 
the possibility is extremely remote that the insulation damage necessary to 
produce such a high rate of boiloff would escape detection prior to propellant 
loading. 

3. 3. 1.1.2 Hydraulic Overpressure 

The possibility of bursting the tanks because of hydraulic (as well as gaseous) 
overpressure was considered (see Fig. 24). This failure would result in the 
overfilling of the propellant tank(s) and the subsequent buildup of hydraulic 
pressure, culminating in tank rupture. 

An analysis of this failure is also presented in Table 4. In this case, the 
adverse pressure would result from a failure in the flow control segments of 
the propellant loading system. Before this event could occur, however, a 
failure in both the automatic and the manual override segments of the system 
would be required. System redundancy and manual override provisions would 
be expected to preclude the occurrence of this type of failure. Further, no 
data were found to indicate that a failure of this nature had occurred in prior 
propellant loading systems. Based on these considerations, hydraulic over- 
pressure is discounted as a failure leading to the gross release of propellant. 

3.3. 1.2 Tank Collapse 

A collapsing failure of the tanks occurs when an adverse pressure differential, 
in excess of structural capabilities, exists across the tank wall due to an 
internal tank pressure lower than the external pressure. Two events are 
considered that are capable of initiating a tank collapse; these events are 
rapid draining of the tank during detank operations and failure of the engine 
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bleed check valves in the lines that provide engine bleed and maintain tank 
pressures when the engines are running (see Fig. 25). A failure analysis of 
the two events is presented in Table 4. A third event, too-rapid chilldown of 
the tank prior to loading, was also considered but was omitted from the 
analysis since only small quantities of propellant would be on-board at that 
time. 

Present design requirements are that the tanks oe designed to be capable of 
sustaining the collapsing pressures resulting from these events. A pressure 
equalization system may be used in lieu of this structural requirement to 
maintain internal pressure within the structural capabilities of the tank. At 
the time of this study, most contractors indicated a preference for the pressure 
equilization system. The low failure rate for critical components in this 
type cf system (see Table 4) indicates that tank collapse due to a failure of 
this system is remote. Although a pressure equalization system will probably 
be used, it is still possible that the tank will maintain its structural integrity 
despite a collapsing pressure differential as a result of meeting other struc- 
tural requirements. 

All booster engines supply bleed pressure to maintain the required pressure 
within the propellant tanks. Contractor reports indicate that tank pressure 
can be maintained within design requirements with as many as four inoperative 
engines. Since a single engine-out is cause for launch abort, the probability 
of tank collapse d^e to lack of adequate engine bleed pressure is remote. 

based on this analysis, the probability of tank collapse as a mechanism for 
the gross release of propellant is considered minimal. 

3.3. 1.3 Or biter Vehicle Dropped 

Structural failure and premature separation were evaluated as events that 
would result if the orbiter vehicle were to drop from the booster. Structural 
failure was considered to occur in the separation mechanism. Premature 
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Fig. 25. Fault Tree - Tank Collapse 





separation was assumed to occur as the result of inadvertent ignition of the 
ordnance associated with the separation system. The sequence of failures 
leading to the dropping of the orbiter from the booster is shown in the partial 
fault tree (see Fig. 26). 

As indicated in the failure analysis (see Table 4), the support structure com- 
prising the separation mechanism is designed to sustain 3-g launch loads 
with a recommended safety factor of 1.5. In addition, the mechanism is 
situated so as to be readily accessible for rigorous postflight and/or preflight 
inspections. Therefore, a structural failure of the support mechanism is not 
expected to occur when the structure is subjected to the 1-g, static, on-pad 
environment. 

Premature separation can occur if the actuation ordnance is ignited via an 
inadvertent, normal actuation signal or a spurious signal. The former can 
be prevented by providing a firing-switch guard and system interlocks to 
prevent arming the system prior to liftoff. Spurious signals have, on very 
few occasions, ignited rocket vehicle ordnance in the past. However, proper 
shielding of ordnance combined with an extensive EMI control program has 
been successful in preventing ordnance actuation via spurious signals in 
current programs (e.g., the lightning strike on the Apollo 12 flight). The 
analysis indicates that premature on-pad separation of the shuttle vehicles 
due to accidental firing of the system ordnance will be preventable. 

Therefore, it is considered improbable that structural failure or inadvertent 
actuation of the separation mechanism would cause the orbiter vehicle to fall 
from the booster during static, on-pad operations, thereby causing the pro- 
pellant tanks to rupture and release gross quantities of propellant. 
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3. 3.1.4 Vehicle Tipover 

Four events that were considered potentially capable of causing tipcver of an 
assembled and loaded vehicle are indicated in Fig. 27. Of these, only tipover 
due to wind effects was evaluated. 


Tipover due to vehicle or launcher structural failure was not evaluated since 
the structures involved were not defined at the time of this study. However, 
this type of failure appears improbable based on experience with current 
vehicles and launch systems. Simularly, lack of data precluded analysis of 
earthquake effects. 

3. 3. 1.4.1 Wind Effects 

Recommended structural design wind parameters for the space shuttle are 
shown in Fig. 28, It is suggested (see Ref. 6) that the vehicle on the launcher 
be capable of sustaining the wind loads developed by a 72. 1-knot wind measured 
at an altitude of 60 ft during the windiest two-week exposure. The recommended 
wind data were extrapolated, and a design wind velocity of 69 knots at a 30-ft 
altitude was obtained. A comparison of this data with wind data recorded for 
the Eastern (ETR) and Western (WTR) Test Ranges (see Table 5) indicates 
that the winds to be expected during periods when the vehicle is on the launch 
pad will be well below the design requirments, not only for the 99-percentile 
winds but for maximum winds as well. Further, a wind-brace arm extending 
from the launch umbilical tower may assist the vehicle to resist wind loads. 

With respect to hurricane winds, sufficient advance warning is provided, and 
the range is closed to launch operations; therefore, a loaded vehicle would 
not be on the pad during a hurricane. 

3.3. 1.5 Lightning Strike 

The last event evaluated as a potential source of a gross release of propellant 
was failure due to a lightning strike (see Table 4). 

A proper grounding and lightning-arrestor system for the vehicle and launcher 
will preclude damage to the vehicle during on-pad operations (e.g., the multiple 
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Table 5. Surface Winds Summary 
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strikes reported while the Apollo 15 vehicle was on the launch pad). Further, 
it is expected that propellant would not be loaded during periods of high elec- 
trical storm probability. The short time (two hours) required to load and 
launch the vehicle tends to ensure this position. 

Finally, in the unlikely event that lightning should strike and rupture the 
propellant tanks, the energy released would produce a nearly instantaneous 
ignition of the propellant); this would tend to produce a low explosive yield 
because the mixing time required to produce a yield approaching 60% TNT 
equivalency would not be available. 

3.3.2 Vehicle Propellant System Failure 

The preceding paragraphs discussed vehicle failure modes that could produce 
a gross release of propellant. In the following paragraphs, the consequences 
of propellant leakage, particularly of and the effect of GN^ as a sup- 

pressant will be discussed. The discussion will be summarized in the failure 
analysis (see Table 6). 

Potential sources of propellant leakage, either gaseous or liquid, are presented 
in Fig. 29. Gaseous propellant leakage warrants special consideration since 
gaseous component leakage was reported to be a significant source of Saturn 
hardware discrepancies. However, any leakage would present a potential 
hazard if the leakages were allowed to accumulate within the vehicle or were 
not properly vented. In addition, although leakage appears as a major con- 
tributor of component discrepancies, normal in specification leakage of a large 
number of components may be a potential source of an explosive atmosphere. 
Ignition of such an atmosphere may produce a relatively low-order explosion; 
however, the result could be the rupture of a propellant tank and the release 
of large quantities of propellant, producing a higher-order secondary explosion. 
The net explosive effect will be further discussed in Sec. 3.3.5. 

3.3.2. 1 Gaseous Leaks 

Component leakage appears to be a major source of discrepancy in the 
acceptability of components (see Ref. 8). Design criteria applicable to 
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the space shuttle (see Ref. 6) specify that the probable failure mode in 
service shall be leakage rather than catastrophic failure when assurance 
of safe -life cannot be provided by proof test. Requirements being defined 
for space shuttle components tend to place tighter restrictions on leakage 
rates (see Ref. 9). This in itself may result in significant impact on the 
component development. Furthermore, multiple reuse of these components 
and requiring them to meet these stringent levels may pose development 
problems. If this should prove to be the case, use of an inert gas purge 
would be one method of alleviating the problem. The approach taken in this 
study was that maximum allowable leakage of components would be 
similar to mat of Saturn S-II components as stated in Ref. 9. The S-II 
(see Refs. 10-12) thus provided a baseline in terms of maximum total 
allowable leakage for components and engines and a basis (see Ref. 13) for 
calculating GN^ purge requirements to maintain an inert atmosphere in the 
purged compartments. 

Total leakage rates from booster and orbiter components were estimated as 
described above; they are shown in Table 7. Estimates of space shuttle 
compartment volumes were obtained from Ref. 14. They were considered 
to be isolated volumes adjacent to the propellant tank ends and vehicle base 
and are shown as shaded areas in the vehicle sketches under Table 8. An 
estimate of the leak distribution throughout the vehicle was made (see 
Table 7). Based on these considerations and the S-II experience (see Refs. 

10 and 13), GNg purge rates of 2150 lb/min and 600 lb/min were estimated 
for the booster and orbiter vehicles, respectively. Such specifics as location 
of purge gas inlets and vents and the elimination of combustible pockets by 
selective purging of portions of the vehicle must be established as the vehicle 
configuration and the location of components are further defined. 

The concentration of GN£ that will suppress combustion in GH 2 atmospheres 
is approximately 50% by volume (see Ref. 15). Assuming a 65% N£ concentra- 
tion, an estimate of the time required for leakage to raise the concentration 
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Table 8. GN, Dilution Required to Suppress GH_ Explosive Potential 


Reported Limits 


Constituent 

% Volume 

GN 2 

50 

gh 2 

50 


93.3 


Suggested Limits 


Constituent % Volume % Weight 


65 97.3 


BOOSTER 
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to 35% by volume within the vehicle compartments is approximately three to 
four hr; these volumes are based on the S-II purge rates (see Table 7). This 
assumes that there is an initial concentration of 100% GN 2 in the vehicle 
spaces surrounding the tank and engine compartment prior to a leaky uniform 
dispersion of leakage H^y and constant leakage of all components at the 
maximum rates allowable by the component specifications. Although this 
may appear to present a tolerable condition in terms of the time to reach 
undesirable H 2 concentrations, the assumptions of uniform leakage and dis- 
persion of throughout the vehicle are not sufficiently conservative. There - 
fore» the use of a GN, purge should be considered a means of preventing a 
rapid, localized buildup in the H 2 concentration. 

Means for venting the propellant tanks safely must be provided. The vent 
lines must lead to a position on the vehicle that will allow the dispersal of 
H 2 away from oxygen and away from ground sources of ignition. 

Some other considerations (see Refs. 16 and 17) affecting the flammability 
of GH 2 and its suppression are the following: 

e Hydrogen is flammable in air at atmospheric 

pressure and room temperature over the range 
of 4 to 75% by volume. As the temperature 
drops, the flammable range narrows. 

• Hydrogen is flammable in an oxygen atmosphere 
at atmospheric pressure and room temperature 
over the range 01 4 to 94% by volume. 

• Unconfined GIL -air mixtures are not likely to be 
detonated by nonexplosive energy initiators such 
as sparks or flames. Partially confined mixtures 
may detonate. Enrichment of unconfined l^-air 
mixtures by the addition of O 2 will not cause 
detonation if the air content exceeds 60% by 

volume and if a nonexplosive ignition source is present. 

• Detonations are likely with near- stoichiometric 
H 2 -0 2 mixtures, high-energy ignition sources, 
confinement, and long flame paths. 
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Gaseous oxygen leaks should present relatively little hazard unless the leakage 
rate is high, or GH^ is simultaneously leaking into the same space, and a 
source of ignition exists. However, N2 purge rates should be adequate to 
suppress initiation of combustion if the components leak at their maximum 
allowable rate. Osygen, of course, supports combustion and would intensify 
any combustion in process at the time of a leak. 


Even with the leakage technology associated with current H2 components, the 
suppressant gas requirements do not appear excessive. The dry N2 purge 
that will be used to prevent condensation on vehicle tanks may also be included 
as a portion of the gaseous leak hazard suppressant. The total requirement 
is based on the distribution of the H2 leakage sources and their rates, together 
with the volume of the purged spaces adjacent to the propellant tanks. 


3. 3.2.2 


Liquid Leaks 


Accumulation of LH2 or O2 from a small-scale leak is not likely to occur. 
Both have such low boiling points that any small flow of liquid would vaporize 
during its escape from the system. 


Sudden release of a sufficiently large quantity (as in the case of a tank puncture) 
can create a large accumulation of liquid. If the liquid remained within the 
vehicle after an LH 2 tank puncture, the H 2 vapor concentration in the vehicle 
would increase rapidly, possibly beyond the upper flammability limit. With 
an otherwise inert atmosphere (air having been excluded by N 2 purge), the 
flammability hazards associated with the leak would be reduced. 

On the other hand, if the H 2 remained liquid as it passed through the vehicle, 
flowed as liquid onto the launch pad, and accumulated there, it would potentially 
be both a flammability and an explosive hazard. The resulting liquid pool 
would tend to evaporate, forming highly flammable concentrations in the pad 
ai^ around the vehicle. Blast pressures, if any, produced by the burning 
of vapors above a pool of LH 2 are small (see Ref. 16). Winds would not increase 
the burning rate; however they would assist in dispersal of the H 2 vapors over 
a large area. 
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A certain amount of air would condense in the event of a large spill and would 
form a shock-sensitive LH^/ solid mixture. The shock stimulus required 

for the explosion of such cryogenic mixtures is quite low; therefore, it 
represents an explosive source that could subsequently involve the larger 
volume of propellant. Unless such an explosion initiated the spillage, however, 
experience appears to indicate that the fire hazard from a large spill exceeds 
the explosion hazard. 

Water vapor significantly affects the thermal energy radiated from an 
flame (see Ref. 16); thus the use of a water deluge in the event of a large 
spill would moderate any ^burning. 

Dilution of liquid cryogenic explosive mixtures with does not reduce the 
impulse or the explosive yield when the ignition source is a detonation (see 
Ref. 17). 

The hazards resulting from L0 2 spills are well known. Liquid oxygen, when 
mixed with organic substances, is explosive. The gas evaporating from a 
liquid pool would support combustion of anything flammable, including sub- 
stances normally considered reasonably fire resistant. Since it is slightly 
denser than air, the GO^ would tend to lie over a surface and to flow down- 
wards, particularly in the absence of winds that might tend to disperse it. 

Any flammable substance, combined with either LO 2 or GO 2 and a source of 
ifnition, would cause a fire (or perhaps an explosion) that could then involve 
the vehicle propellant tanks. If a detonation were the energy source initiating 
an explosion, the availability of the time involved, and the quantity mixed 
with oxidizer would determine the magnitude of the explosive yield of the 
propellant in the vehicles. 

3.3.3 Ignition Sources 

In order for a combustible mixture to burn or fexplode, an energy source must 
initiate the process. If a low-level energy source that might normally initiate 
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a fire occurred in a confined space, an explosion could result. An uncontrolled 
ignition source without a suitable combustible mixture would not necessarily 
pose an immediate problem although it could subsequently initiate a propellant 
hazard. The more obvious ignition sources such as lightning, a fire originating 
outside the vehicle, and frictional energy due to accidental impact ai ~ presented 
in Fig. ' v . The somewhat less obvious but ever-present ignition sources such 
as hot surfaces of AFUs, heat exchangers, and AC PS sources; and recirculation 
of hot gases during the ignition transient of the main engines are also con- 
sidered. In addition, the generation and discharge of electrostatic charges 
may be sufficient to ignite a combustible mixture. 

Abnormal fluid -i" dw conditions such as waterhammer in liquid systems and 
compressive heating in gaseous systems are of concern in the oxidizer lines, 
where this form of concentrated energy release might be sufficient to initiate 
a reaction between the and its container . 

Constant attention should be given during design and development of the 
components, systems, and vehicle to devising means of eliminating or 
minimizing the occurrence of such sources. Some considerations are pro- 
vided in Tables 9 and 10. Care should be exercised to isolate source of 
energy such as AFUs or heat exchangers, to provide inert gas purges to 
dilute gaseous combustible mixtures, and (in some cases ) to act as explosion 
suppressants. Locating such hardware outside potential pockets of combus- 
tible accumulation is desirable. Warning sensors that will initiate appro- 
priate and timely action should be located in the areas of both known and 
potentially uncontrolled energy sources. Screens or Harriers should be 
used to isolate components that may be particularly hazardous. Design of 
all electrical circuits and connections should be in accordance with 
applicable provisions for their use in hazardous atmospheres. 
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Tab^e 9. Failure Analysis-Internal Ignition Sources 
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Table 9. Failure Analysis -Internal Ignition Sources (Continued) 
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Table 10. Failure Analysis -External Ignition Sources 
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3.3.4 Evaluation of Explosive Potential 

3. 3.4.1 Considerations Based on Existing Criterion 

The present 60% TNT equivalency criterion for LO^/LH^, propellant is based 
on the total propellant weight on-board a vehicle (in this instance, 4 X 10^ lb). 
Further, the criterion is predicated on the toted release and mixing of pro- 
pellant prior to ignition. 

The distribution of the main propulsive propellant within a typical two-stage 
space shuttle vehicle is shown in Fig. 31. The key information in this figure 
is the fact that the propellant is contained in five separate tanks, two in the 
booster and three in the orbiter. It is obvious, therefore, that to obtain a 
total release of propellant as stipulated by the present criterion would require 
the simultaneous failure of five propellant tanks in two vehicles. The 
improbability of the occurrence of failures that could produce a gross release 
of propellant was discussed in Sec. 3.3.1. Further, many energy sources 
are available on the vehicle, including the energy resulting from the failure, 
that are capable of igniting large propellant spills before mixing sufficient 
to develop yields approaching the 60% TNT equivalency value can take place. 

3. 3.4. 2 Multiple Tank Failures 

In order to have an explosion involving all the propellant from two or more 
tanks (one or more of which must contain LH^), the rupture of the individual 
tanks would have to occur essentially simultaneously to allow the degree of 
propellant mixing necessary to result in a high-order explosion rather than 
a fire. 

There are thirty- one combinations in which the Eve main propellant tanks 
on the space shuttle could fail. The explosive yield of each failure was 
evaluated on the basis of the current 60% TNT equivalency criterion, which 
assumes the total release and mixing of all propellant in the tanks involved. 
The resulting yields were used to establish a yield ratio that relates the 
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Fig. 31. Propellant Distribution 
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calculated yield of the particular tank failure combination to the total propellant 
on-board the vehicle, 4 X 10^ lb. (The details of the evaluation are presented 
in Table 11.) 

The results indicate that only twelve of the thirty-one failure combinations 
will produce yields in excess of 20% TNT equivalency of the total vehicle 
(see Table 12). By way of comparison, a gross static failure of the entire 
orbiter (failure mode 12, Table 11) produces a 9% yield, and failure mode 30, 
which includes all tanks except the booster LC^ tank, indicates a yield of 
only 16.5%. Moreover, these all involve multiple tank failures, and all but 
one involve both the booster and the orbiter vehicles. The probability of the 
simultaneous failure of two or more of the propellant tanks, at least one of 
which must be a tank, is very remote. Further, the only opportunity 
for the total quantity of the released propellant to combine would be on the 
ground; this would require the LH^ released from the orbiter tank to travel 
essentially the full length of the vehicle without encountering an ignition 
source, an improbable situation. 

3. 3. 4. 3 Single Tank Failures 

If a failure should occur in the propellant tanks, it would be most likely to 
be a single tank failure. Of the five possible single tank failures, only the 
failures of the two LH^ tanks are of interest for the purpose of this study. 

air mixtures; LO^ is considered 
a fire hazard rather than an explosive hazard. The yield- ratio calculations 
(see Table 11) show equivalent TNT yields of 1.5 and 7.5% for failure of the 
orbiter and booster tanks, respectively. 

If the ruptured tank were an tank, it was assumed that an explosion would 
not occur, but that a fire might result. Explosions of other propellant aboard 
the vehicle as a result of the fire would be of a low order since the fire will 
act as a nearly instantaneous ignition source and preclude the propellant 
mixing required to obtain a high explosive yield. 


The ASESB 60% criterion also pertains to HL,/ 
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All weights are in millions of pounds . 


















Table 12. Multiple Tank Failures Producing Yields 
in Excess of 20% TNT Equivalency 
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3. 3.4.4 Propagation of an Explosive Failure 

Although it is improbable that all five propellant tanks would be involved in 
an initial explosive failure* it is reasonable to expect that a failure of a 
magnitude sufficient to rupture a propellant tank would propagate so as to 
include all tanks. 

This expectation is based on the consideration that the initial explosive event 
would result in a low-order yield with respect to the explosive potential of 
the total on-board propellant. The debris* pressure wave* and/or fire 
resulting from this event could rupture one or more of the adjacent pro- 
pellant tanks and result in a secondary explosion. The yield of the secondary 
explosion* although possibly exceeding the magnitude of the initial explosion, 
would not be expected to approach the current 60% TNT equivalency criterion 
because the fire and energy release of the initial explosive event would provide 
a ready ignition source for any propellant released in subsequent failures. 

The nearly instantaneous ignition of this propellant would not allow the pro- 
pellant-mixing time required to develop high-order explosive yields. Most 
of the propellant released in sequential failures of this nature would only add 
to the existing deflagration and would not increase the overall explosive yield. 
Estimates of the explosive yields resulting from the failures of a Saturn S-1VB 
stage during test and a Centaur vehicle during launch tend to confirm this 
rationale. In both instances* the explosive yield (based on total on-board pro- 
pellant) was estimated to be less than 10% TNT equivalency. 

3.3.5 Evaluation of Yield Probability 

Studies for other vehicles have indicated that the probability of the occurrence 
of a failure such as a tank rupture* which could result in the explosion of 
and LC>2» is very low. For instance* data from an analysis for the Titan 1I1M 
vehicle indicated that the probability of a tank rupture during the time period 
from T minus 30 to T minus 0 min was approximately 0.4 X 10*^. It is 
generally considered that the probability of a tank rupture on the pad would 
also be very low. 
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In spite of the anticipated low probability of the occurrence of a situation that 
could result in an on-pad explosion, there is the question of the magnitude 
of the esqplosion if such an event should occur. A statistical development of 
the yield of exploding propellant for a multitank vehicle configuration such 
as the one used on the EOS was performed; it is presented in detail (see 
Appendix D, Vol 111 of this series). 

In that analysis, probability density function models for the yield of an 
explosion were first developed. The properties of these models were then 
used to establish composite probability density functions, considering the 
fact that various EOS tank combinations (hence, different quantities of 
propellant) would be involved in the explosion. The composite probability 
density functions were then used as the basis for probability statements 
relative to the equivalent TNT yield of an EOS fully loaded with LO 2 /LH 2 
propellant. 

The results of this analysis indicate that if a failure should occur, the 
probability of attaining a yield approaching 60% TNT equivalency of a fully 
loaded space shuttle is low. Table 13 shows the probabilities of exceeding 
20, 60, and 100% TNT equivalency yields as indicated by each of the models. 
It will be noted that Model 4 indicates only a 6% probability of exceeding a 
yield of 20% TNT equivalency (see Fig. 32). 

I should be noted, however, that the probability density function for Model 4 
is based on experimental data obtained from a series of tests that consisted 
predominantly of small-scale (200 lb) tests for which yields as high as 100% 
TNT equivalency were reported. The test series also included a few tests 
involving propellant weights of 1000, 25,000 and 91,000 lb for which TNT 
equivalencies were reported in the range of approximately 40 to 3.5%, the 
TNT equivalency decreasing as propellant test weight increased. 

There is some concern that this experimental data might not be a good 
statistical sample for use in the analysis since few tests were run using 
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Table 13. Probability of Exceeding a Given 
% TNT Equivalency 


Model 

% TNT Equivalency * 

20 

60 

100 

1 

0.19 

0.04 

0.0 

2 

0.19 

o.of 

<0.01 

3 

0.06 

<0.01 

<0.01 

4 

0.06 

<0.01 

<0.01 

5 

0.19 

0.09 

0.03 


large propellant quantities, and the manner in which the LC^ and LH^ were 
brought together in the tests might not correspond to failure modes anticipated 
for the space shuttle. For instance, the small number of tests involving 
large propellant quantities might be the basis for concern that Model 4 is 
biased towards low yields. On the other hand, the results of the failure 
analysis for the static, on-pad phaje of space shuttle operations indicate 
that the TNT equivalency for the large* propellant quantitic s on-board the 
space shuttle might be expected to produce yields lower than those indicated 
by Model 4. It therefore appears that Model 4 might actually be conservative 
from the standpoint of yields to be expected in the event of an explosive failure 
involving the main propellant tanks of the space shuttle. 

3.3.6 Summary of Suggested Preventive or Remedial Criteria 

Recommendations fer reducing the on-pad hazards fall into three categories: 



• Prevention or isolation of hazardous combustible 
conditions and ignition sources 

• Installation of sensors within the vehicles and on 
ground systems to detect an impending hazardous 
condition 
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• Initiation of timely actions such as venting, 
unloading propellant, and use of fire sup- 
pressants if a potentially dangerous condition 
is detected. 

The area that will provide the greatest benefit is the prevention or isolation 
of hazardous conditions. Requirements established early in the program will 
help to preclude hazards by: 

• Designing the propellant tanks to preclude 
collapse under adverse draining conditions. 

• Avoiding tank bulkheads common to both 
LC>2 and LH2 . 

• Avoiding placement of high-pressure gas storage 
bottles within propellant tanks. 

• Providing adequate overpressure relief where 
fluid lines, components, or tanks may be subjected 
to localized high temperatures. 

• Incorporating debris shields between main pro- 
pellant tanks and between subsystems or components 
subjected to high pressures and high rotational speeds. 

• Maximizing the use of compatible and nonflammable 
materials. 

• Purging the vehicle compartments with dry N2 to 
maintain an inert, nonflammable atmosphere. 

Such an atmosphere should be established prior to 
propellant loading. Care should be exercised in 
locating purge gas inlets and outlets to avoid non- 
purged pockets in which H2 might accumulate. 

• Jacketing flanged connections to collect any H2 
leakage and vent it overboard. 

Since leaks (especially of GH2) are probable, sensors capable of detecting a 
hazardous atmosphere or fire within the vehicle should be included and 
should provide for termination of propellant loading or increase of purge 
flow, if needed. The sensing /warning system should be designed to minimize 
the occurrence of false warnings and yet provide a minimal reaction time in 
the event of an emergency. 
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The initiation of timely action would depend on the type of threshold detection 
and on the sensitivity of the sensor systems. It should be incorporated into 
a system to increase the flow of as a diluent or fire suppressant or to 
initiate a water deluge to reduce the possible thermal effects. 

It is recommended that a program of designing for minimal hazard be rigor- 
ously pursued at the component, subsystem, and system levels for the vehicle 
and ground equipment. As systems become better defined and specific data 
become available, periodic reassessment of specific flammability and explosive 
hazards will be required. 



! i 


© 

-85- 







4. CONCLUSIONS AND RECOMMENDATIONS 


4. 1 CONCLUSIONS 

The current 60% TNT equivalency criterion for LC^/L^ propellant is based 
on the total weight of propellant in the vehicle. The criterion predicates that 
a total release and mixing of propellant will occur prior to ignition. 

The distribution of propellant in the space shuttle (EOS) is such that a 
simultaneous failure of five separate propellant tanks, two in the booster 
and three in the orbiter, would have to occur to produce a total release of 
propellant. The failure analysis indicates that this is an improbable failure 
mode for the space shuttle. However, should such a failure occur, the only 
opportunity for the total quantity of propellant to combine would be outside 
the vehicle. It is not reasonable to expect that the released propellant would 
escape ignition during the time required to allow such a combination of 
propellant. 

If a tank failure were to occur, it would be most likely to be the outcome of 
an initial failure in some other system (e.g., a low-yield explosion due to 
gaseous propellant leakage from seals or components or to debris resulting 
from a high-pressure bottle failure). It is expected that the energy available 
in a failure of this nature would be sufficient to ignite the propellant before 
any appreciable mixing could occur. Therefore, the resulting explosive yield 
would be low, and most of the propellant released would be consumed in the 
ensuing deflagration. It is also expected that, should this type of failure 
occur, it would probably propagate throughout the vehicle. As this failure 
progressed throughout the vehicle, additional low-yield explosions might 
occur; however, they are not expected to be additive, nor is the yield of any 
individual explosion expected to exceed a TNT equivalency of 20% of the total 
propellant initially on-board the vehicle. This rationale is supported by the 
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yields reported for the failures of a Centaur vehicle and a Saturn S-IVB stage. 
The TNT equivalency estimated for both of those failures was less than 10% 
of the on-board propellants. 

A conservative statistical analysis indicates that if a tank failure should occur, 
there is only a 6% probability that it would exceed a TNT equivalent yield of 
20% of the total on-board propellants. 

Therefore, it is concluded that a value of 20% TNT equivalency is a more 
realistic criterion to apply to the LC^/L.!^ propellant of the space shuttle 
(EOS) during its static, on-pad phase of operations than the presently used 
value of 60%. While the analysis of available explosion test data 

does not permit extrapolation of the data to the large propellant quantities 
of the space shuttle or its use as a firm basis for such a conclusion, the 
apparent trend of this test data combined with the results of the failure analy- 
sis tends to support a lowering of the TNT equivalency value. 

4.2 RECOMMENDATIONS 

Based on the results of the failure and statistical analyses, it is recommended 
tjiat the 60% TNT equivalency criterion for LO 2 /LH 2 propellant currently 
applied to the static, on-pad phase of space shuttle (EOS) operations be 
lowered to a value of 20% based on the total weight of propellants on-board 
the vehicle. 
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